1679581 - Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at /builds/worker/checkouts/gecko/third_party/rust/euclid/src/point.rs:390

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Hit MOZ_CRASH(called Option::unwrap() on a None value) at /builds/worker/checkouts/gecko/third_party/rust/euclid/src/point.rs:390

#0 0x7f6fbe4fee75 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:254:3
#1 0x7f6fbe4fee75 in RustMozCrash src/mozglue/static/rust/wrappers.cpp:17:3
#2 0x7f6fbe4fee24 in mozglue_static::panic_hook::h6e70bafc479dc06d src/mozglue/static/rust/lib.rs:89:9
#3 0x7f6fbe4fe74b in core::ops::function::Fn::call::h01fce3a141895069 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:70:5
#4 0x7f6fbf4c4ea7 in std::panicking::rust_panic_with_hook::haa1ed36ada4ffb03 /rustc/18bf6b4f01a6feaf7259ba7cdae58031af1b7b39/library/std/src/panicking.rs:573:17
#5 0x7f6fbf4c4a58 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h7001af1bb21aeaeb /rustc/18bf6b4f01a6feaf7259ba7cdae58031af1b7b39/library/std/src/panicking.rs:476:9
#6 0x7f6fbf4bfecb in std::sys_common::backtrace::__rust_end_short_backtrace::h39910f557f5f2367 /rustc/18bf6b4f01a6feaf7259ba7cdae58031af1b7b39/library/std/src/sys_common/backtrace.rs:153:18
#7 0x7f6fbf4c4a18 in rust_begin_unwind /rustc/18bf6b4f01a6feaf7259ba7cdae58031af1b7b39/library/std/src/panicking.rs:475:5
#8 0x7f6fbf52adc0 in core::panicking::panic_fmt::h4e2659771ebc78eb /rustc/18bf6b4f01a6feaf7259ba7cdae58031af1b7b39/library/core/src/panicking.rs:85:14
#9 0x7f6fbf52ad0c in core::panicking::panic::h4b079e3c35cc1b09 /rustc/18bf6b4f01a6feaf7259ba7cdae58031af1b7b39/library/core/src/panicking.rs:50:5
#10 0x7f6fbdfdce76 in webrender::renderer::Renderer::draw_frame::hc1c13f2343c96251 src/gfx/wr/webrender/src/renderer.rs
#11 0x7f6fbdfb0c33 in webrender::renderer::Renderer::render_impl::he83997d099c56357 src/gfx/wr/webrender/src/renderer.rs:3663:17
#12 0x7f6fbdfadf0a in webrender::renderer::Renderer::render::he364f654a8330632 src/gfx/wr/webrender/src/renderer.rs:3414:30
#13 0x7f6fbdd0630c in wr_renderer_render src/gfx/webrender_bindings/src/bindings.rs:614:11
#14 0x7f6fb7e21b6e in mozilla::wr::RendererOGL::UpdateAndRender(mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool*, mozilla::wr::RendererStats*) src/gfx/webrender_bindings/RendererOGL.cpp:193:8
#15 0x7f6fb7e20944 in mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, bool, mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool*) src/gfx/webrender_bindings/RenderThread.cpp:488:31
#16 0x7f6fb7e203bf in mozilla::wr::RenderThread::HandleFrameOneDoc(mozilla::wr::WrWindowId, bool) src/gfx/webrender_bindings/RenderThread.cpp:325:3
#17 0x7f6fb7e294de in applyImpl<mozilla::wr::RenderThread, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, bool), StoreCopyPassByConstLRef<mozilla::wr::WrWindowId>, StoreCopyPassByConstLRef<bool> , 0, 1> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1096:12
#18 0x7f6fb7e294de in apply<mozilla::wr::RenderThread, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, bool)> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1102:12
#19 0x7f6fb7e294de in mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, bool), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId, bool>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1148:13
#20 0x7f6fb6dc7acf in MessageLoop::RunTask(already_AddRefed<nsIRunnable>) src/ipc/chromium/src/base/message_loop.cc:465:9
#21 0x7f6fb6dc8615 in MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&) src/ipc/chromium/src/base/message_loop.cc:473:5
#22 0x7f6fb6dc88ba in MessageLoop::DoWork() src/ipc/chromium/src/base/message_loop.cc:548:13
#23 0x7f6fb6dc92a0 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) src/ipc/chromium/src/base/message_pump_default.cc:35:31
#24 0x7f6fb6dc7793 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:334:10
#25 0x7f6fb6dc76ad in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
#26 0x7f6fb6dc76ad in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
#27 0x7f6fb6dd5937 in base::Thread::ThreadMain() src/ipc/chromium/src/base/thread.cc:191:16
#28 0x7f6fb6dd0ea9 in ThreadFunc(void*) src/ipc/chromium/src/base/platform_thread_posix.cc:40:13
#29 0x7f6fcbbb2608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477:8
#30 0x7f6fcb77b292 in clone /build/glibc-ZN95T4/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Tyson Smith [:tsmith]]

Attachment: prefs.js

Comment 2

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/57gOsGlBEZCilL1UIdPXBg/index.html

Comment 3

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20201127155321-c42696dc97c6.
The bug appears to have been introduced in the following build range:

Start: 5e54b29e93d4ff891bcb3d7461c57ddef351e437 (20200507193514)
End: 5ffbc60264521aa053e4be8baf715c515202546f (20200507195409)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5e54b29e93d4ff891bcb3d7461c57ddef351e437&tochange=5ffbc60264521aa053e4be8baf715c515202546f

Comment 4

[Jim Blandy :jimb]

S3 because impact unclear; P2 because highly actionable, because Pernosco

Comment 5

[Glenn Watson [:gw]]

This doesn't appear to occur in current m-c, with either sw-wr or hw-wr. Can anyone else confirm?

Comment 6

[Jim Blandy :jimb]

I can't reproduce this from the test case, either.

But the test case is based on a magic number (setting height to 73189319), so it wouldn't surprise me if it were sensitive to resource limits.

Does the Pernosco trace help?

Comment 7

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Comment 8

[Tyson Smith [:tsmith]]

How about this test case? The fuzzers have reported this many times so I have lots to work with.

Comment 9

[Glenn Watson [:gw]]

Unfortunately that one also doesn't repro locally for me (tried regular + full debug builds), changing layout.css.devPixelsPerPx and also changing resolution (1080p and 4k). Are there any other preferences I should try tweaking that you can think of? Are you able to get a pernosco session for that new test case?

Comment 10

[Tyson Smith [:tsmith]]

(In reply to Glenn Watson [:gw] from comment #9)

Are there any other preferences I should try tweaking that you can think of?

I can't think of any prefs that might make a difference.

Are you able to get a pernosco session for that new test case?

Sure, I will attach link when it's ready.

Comment 11

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/WXomgmyLDEI2uKBj5vopoQ/index.html

Comment 12

[Mayank Bansal]

Got a crash from the testcase : https://crash-stats.mozilla.org/report/index/bc39a68b-bbf3-4562-809a-e742c0210607#tab-bugzilla

Comment 13

[Darkspirit]

Can't repro a crash, but I see glitches when zooming in and out: Parts of the black box remain.

Comment 14

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20201127155321-c42696dc97c6) but not with tip (mozilla-central 20211105214712-019196b56630.)
Failed to bisect testcase (Start build didn't crash!):

Start: c42696dc97c623acea5083ffcfef03a5f990756a (20201127155321)
End: 019196b56630ab8806c88dcd890fcc3a13817084 (20211105214712)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 15

[Jim Blandy :jimb]

I'm also not able to reproduce using the test case from comment 7.

Comment 16

[Tyson Smith [:tsmith]]

The fuzzers last reported this while fuzzing with m-c 20211104-50e4a4e6975a.

Comment 17

[Tyson Smith [:tsmith]]

So maybe it was fixed by: https://bugzilla.mozilla.org/show_bug.cgi?id=1730695#c17

I'm happy to close this if that is ok with you.